Skip to main content

Class: PasskeyStrategy

Defined in: src/auth/PasskeyStrategy.ts:78

Implements an authentication strategy for performing WebAuthn/Passkey (FIDO2) login.

The login flow has two phases:

  1. Challenge - The client requests a challenge. A random challenge is generated and stored in the session, and the resulting options are returned for use with navigator.credentials.get().
  2. Verify - The client submits the signed assertion response. The response is verified against the stored challenge and the credential's public key, the credential's signature counter is updated, and the associated user is resolved via verify().

NOTE: Requires session support!

Implements​

  • AuthStrategy

Constructors​

Constructor​

new PasskeyStrategy(options): PasskeyStrategy

Defined in: src/auth/PasskeyStrategy.ts:82

Parameters​

options​

PasskeyStrategyOptions

Returns​

PasskeyStrategy

Properties​

name​

readonly name: string = "passkey"

Defined in: src/auth/PasskeyStrategy.ts:79

The unique name of the strategy used to register with the AuthMiddleware.

Implementation of​

AuthStrategy.name

Methods​

authenticate()​

authenticate(req, res, required?): Promise<AuthResult | undefined>

Defined in: src/auth/PasskeyStrategy.ts:86

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

Parameters​

req​

HttpRequest

The request containing data to attempt authentication with.

res​

HttpResponse

The response to use when writing back directly to the client.

required?​

boolean

Set to true to if authentication is required to pass, otherwise set to false.

Returns​

Promise<AuthResult | undefined>

Implementation of​

AuthStrategy.authenticate

authenticateSync()​

authenticateSync(req, res, required?): AuthResult | undefined

Defined in: src/auth/PasskeyStrategy.ts:98

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

This is the synchronous version of authenticate that performs blocking based authentication.

Parameters​

req​

HttpRequest

The request containing data to attempt authentication with.

res​

HttpResponse

The response to use when writing back directly to the client.

required?​

boolean

Set to true to if authentication is required to pass, otherwise set to false.

Returns​

AuthResult | undefined

Implementation of​

AuthStrategy.authenticateSync

challenge()​

protected challenge(req, res): Promise<undefined>

Defined in: src/auth/PasskeyStrategy.ts:110

Begins a login ceremony: generates a challenge, stores it in the session, and writes the resulting options directly to the response for the client to pass to navigator.credentials.get().

Parameters​

req​

HttpRequest

The source HTTP request. May optionally carry a uid query parameter to scope the allowed credentials to a known user; omitted entirely for a discoverable/"usernameless" flow.

res​

HttpResponse

The response to write the generated options to.

Returns​

Promise<undefined>

verify()​

protected verify(req, required?): Promise<AuthResult | undefined>

Defined in: src/auth/PasskeyStrategy.ts:158

Finishes a login ceremony: verifies the client-submitted assertion response against the stored challenge and credential, updates the credential's signature counter, and resolves the associated user.

Parameters​

req​

HttpRequest

The source HTTP request, carrying the assertion response in its body.

required?​

boolean

Set to true if authentication is required to pass, otherwise set to false.

Returns​

Promise<AuthResult | undefined>